Third-Party Authorization of Access Tokens

ABSTRACT

A method for third-party authorization is presented. A client request is received by a resource server in a computer system from a client, wherein the client request includes an access token. An introspection request for the access token based on the client request. The introspection gateway uses a third-party authorization server from a plurality of third-party authorization servers to handle the introspection request. A resource server response is received from the introspection gateway, wherein the resource server response identifies a set of scopes for the access token. A determination is made as to whether the access token has sufficient scope from the resource server response. In response to the access token having the sufficient scope, the client is granted access to the resource server.

BACKGROUND 1. Field

The disclosure relates generally to an improved computer system and,more specifically, to a method, an apparatus, and a computer programproduct for processing authorization tokens to access a resource server.

2. Description of the Related Art

Open authorization (OAuth) is an open standard for token-based accessdelegation to third parties to access user information on the Internet.This architecture allows an end user's account information to be used bythird-party services without exposing the user's password. With thistype of access control, secure delegated access to server resources canbe made on behalf of a resource owner. A process is employed forresource owners to authorize third-party access to their serverresources without sharing their credentials. This process is designed towork with Hypertext Transfer Protocol (HTTP). OAuth essentially allowsaccess tokens to be issued to third-party clients by an authorizationserver with the approval of the resource owner. The third-party thenuses the access token to access the protected resources hosted by theresource server.

For example, an incoming request to a resource server provides therequestor access to resources if the request contains sufficient scopes.For example, when a request is received to access a resource server,OAuth access token identifies a list of scopes. This process is alsoreferred to as introspection and is performed against the authorizationserver that issued the OAuth access token. In some cases, the resourceserver may include an internal authorization server, use an externalthird-party authorization server, or some combination thereof.

An external third-party authorization server could be used for a numberof different reasons. For example, the security capabilities ofauthorization servers may differ among the different authorizationserver providers. For example, additional security features may bepresent for mobile clients. In another example, a customer may requireits own authorization server for its specific security requirements.

The protocol used to introspect access tokens can be different betweendifferent third-party authorization server providers. The resourceserver implements the protocol use by the third-party provider for theirauthorization servers. This requirement can be a challenge. For example,if a new authorization provider is selected to replace an existingauthorization provider or as an additional authorization provider,changing the code to support this new authorization provider may be moredifficult than desired. For example, making changes in a large or legacysystem may be more difficult and expensive than desired, as well astaking more time that desired.

SUMMARY

According to one embodiment of the present invention, a method forthird-party authorization is presented. A client request is received bya resource server in a computer system from a client, wherein the clientrequest includes an access token. An introspection request for theaccess token based on the client request, wherein the introspectiongateway uses a third-party authorization server from a plurality ofthird-party authorization servers to handle the introspection request. Aresource server response is received from the introspection gateway,wherein the resource server response identifies a set of scopes for theaccess token. A determination is made as to whether the access token hassufficient scope from the resource server response. In response to theaccess token having the sufficient scope, the client is granted accessto the resource server.

According to another embodiment of the present invention, a computersystem comprising a resource server running on the computer system ispresented. The resource server receives a client request from a clientin which the client request includes an access token. The resourceserver sends an introspection request to an introspection gateway,wherein the introspection request is for introspection of the accesstoken based on the client request, and wherein the introspection gatewayuses a third-party authorization server from a plurality of third-partyauthorization servers to handle the introspection request. The resourceserver receives a response from the introspection gateway, wherein theresponse identifies a set of scopes for the access token. The resourceserver determines whether the access token has sufficient scope from aresource server response. The client is granted access to the resourceserver in response to the access token having the sufficient scope.

According to yet another embodiment of the present invention, a computerprogram product for third-party authorization is presented. The computerprogram product comprises a computer-readable storage media, whereinfirst program code, second program code, third program code, fourthprogram code, and fifth program code are stored. The first program codereceives a client request from a client, wherein the client requestincludes an access token. The second program code sends an introspectionrequest for the access token based on the client request, wherein theintrospection gateway uses a third-party authorization server from aplurality of third-party authorization servers to handle theintrospection request. The third program code receives a response fromthe introspection gateway, wherein the response identifies a set ofscopes for the access token. The fourth program code determines whetherthe access token has sufficient scope from the response. The fifthprogram code grants the client access to a resource server in responseto the access token having the sufficient scope.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a token introspection environment inaccordance with an illustrative embodiment;

FIG. 2 is a data flow diagram for handling a client request to access toa resource in accordance with an illustrative embodiment;

FIG. 3 is a flowchart of a process for third-party authorization toaccess a resource server in accordance with an illustrative embodiment;

FIG. 4 is a flowchart of a process for delegating introspection of anaccess token in accordance with an illustrative embodiment; and

FIG. 5 is a block diagram of a data processing system in accordance withan illustrative embodiment.

DETAILED DESCRIPTION

The present invention may be a system, a method, and/or a computerprogram product. The computer program product may include acomputer-readable storage medium (or media) having computer-readableprogram instructions thereon for causing a processor to carry outaspects of the present invention.

The computer-readable storage medium can be a tangible device that canretain and store instructions for use by an instruction executiondevice. The computer-readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer-readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random-access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random-access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer-readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer-readable program instructions described herein can bedownloaded to respective computing/processing devices from acomputer-readable storage medium or to an external computer or externalstorage device via a network, for example, the Internet, a local areanetwork, a wide area network, and/or a wireless network. The network maycomprise copper transmission cables, optical transmission fibers,wireless transmission, routers, firewalls, switches, gateway computers,and/or edge servers. A network adapter card or network interface in eachcomputing/processing device receives computer-readable programinstructions from the network and forwards the computer-readable programinstructions for storage in a computer-readable storage medium withinthe respective computing/processing device.

Computer-readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, or either source code or object code written in anycombination of one or more programming languages, including an objectoriented programming language such as Smalltalk, C++ or the like, andconventional procedural programming languages, such as the “C”programming language or similar programming languages. Thecomputer-readable program instructions may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer, or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider). In some embodiments, electronic circuitry including, forexample, programmable logic circuitry, field-programmable gate arrays(FPGA), or programmable logic arrays (PLA) may execute thecomputer-readable program instructions by utilizing state information ofthe computer-readable program instructions to personalize the electroniccircuitry, in order to perform aspects of the present invention.

Aspects of the present invention are described below with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer-readable program instructions.

These computer program instructions may be provided to a processor of ageneral-purpose computer, a special purpose computer, or otherprogrammable data processing apparatus to produce a machine, such thatthe instructions, which execute via the processor of the computer orother programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer program instructions may also bestored in a computer-readable medium that can direct a computer, otherprogrammable data processing apparatus, or other devices to function ina particular manner, such that the instructions stored in thecomputer-readable medium produce an article of manufacture includinginstructions which implement the function/act specified in the flowchartand/or block diagram block or blocks.

The computer-readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

The illustrative embodiments recognize and take into account that itwould be desirable to have a method, an apparatus, and a computerprogram product that overcome a problem with changing authorizationservice providers, as well as possibly other problems. The illustrativeembodiments provide a method, an apparatus, and a computer programproduct for accessing resources using third-party authorization. In oneillustrative example, a method is present for third-party authorization.A resource server in the computer system receives a client request froma client, wherein the client request includes an access token. Theresource server sends an introspection request to an introspectiongateway for the access token based on the client request, wherein theintrospection gateway uses a third-party authorization server from aplurality of third-party authorization servers to handle theintrospection request. The resource server response is received from theintrospection gateway, wherein the response identifies a set of scopesfor the access. A determination is made as to whether the access tokenhas a sufficient scope from the response. Responsive to the access tokenhaving the sufficient scope, the resource server grants the clientaccess to the resource server.

With reference now to the figures and, in particular, with reference toFIG. 1, a block diagram of a token introspection environment is depictedin accordance with an illustrative embodiment. As depicted in resourceaccess environment 100, client 102 can access resources 104 throughresource server 106 using token introspection. In this illustrativeexample, client 102 may have limited resource access to resources 104.Client 102 can take a number of different forms. For example, client 102may be a desktop application, a web application, a mobile application,or some other suitable type of client.

Resources 104 can be, for example, at least one of a document, aspreadsheet, a webpage, a social media service, a social networkingservice, a bank account, or some other type of resource. As used herein,the phrase “at least one of,” when used with a list of items, meansdifferent combinations of one or more of the listed items may be used,and only one of each item in the list may be needed. In other words, “atleast one of” means any combination of items and number of items may beused from the list, but not all of the items in the list are required.The item may be a particular object, a thing, or a category.

For example, without limitation, “at least one of item A, item B, oritem C” may include item A, item A and item B, or item B. This examplealso may include item A, item B, and item C or item B and item C. Ofcourse, any combinations of these items may be present. In someillustrative examples, “at least one of” may be, for example, withoutlimitation, two of item A; one of item B; and ten of item C; four ofitem B and seven of item C; or other suitable combinations.

In this illustrative example, client 102 can send client request 108 toresource server 106 over network 136. Network 136 may take a number ofdifferent forms. For example, network 136 is selected from at least oneof a local area network, a wide area network, an intranet, the Internet,or some other suitable type of network.

Client request 108 is a request for access to resources 104 without user110 providing a password to client 102. This access may be, for example,reading, changing, or writing information in resources 104. For example,client request 108 may be a request to obtain information for user 110.

In this illustrative example, client 102 has access token 112, which isused in lieu of a password. Access token 112 contains information thatcan be used to provide client 102 permissions or privileges to accessresource server 106 and in turn access resources 104.

For example, access token 112 can contain security credentials for alogin session and identify a user, user groups, user privileges, aparticular application, or other suitable types of information. In thisillustrative example, access token 112 is an OAuth token. This token andother processes, such as those for introspection of the OAuth token, canbe implemented under the standard OAuth 2.0 published as RFC 6749.

As depicted, resource server 106 receives client request 108 from client102 in which client request 108 includes access token 112. Resourceserver 106 sends introspection request 114 to introspection gateway 116.In this illustrative example, resource server 106 and introspectiongateway 116 can be implemented in software, hardware, or somecombination thereof.

Introspection request 114 is for introspection of access token 112 inwhich introspection request 114 is based on client request 108.Introspection gateway 116 and resource server 106 are located incomputer system 134. Computer system 134 is a physical hardware systemand includes one or more data processing systems. When more than onedata processing system is present, those data processing systems are incommunication with each other using a communications medium. Thecommunications medium may be a network. For example, the network may beselected from at least one of a local area network, a wide area network,Internet, the Internet, or some other suitable type of network. The dataprocessing systems may be selected from at least one of a computer, amobile device, see a workstation, a server computer, a tablet, or someother suitable data processing system. In this illustrative example,resource server 106 and introspection gateway 116 are depicted to be oncomputer system 134. In other illustrative examples, these componentsmay be located on different computer systems.

Resource server 106 receives resource server response 118 fromintrospection gateway 116. In this illustrative example, resource serverresponse 118 identifies a set of scopes 120 for access token 112. Theset of scopes 120 is identified as part of the introspection process inthis illustrative example.

As used herein, “a set of,” when used with respect to items, means oneor more items. In other words, “a set of scopes 120” is one or more ofscopes 120. In this illustrative example, a scope in scopes 120 is aclient permission. In other words, the scope defines what type of accessthat client 102 can have based on access token 112.

Resource server 106 also determines whether access token 112 hassufficient scope from the set of scopes 120 in resource server response118, and grants client 102 access to resource server 106 in response toaccess token 112 having sufficient scope.

In this illustrative example, introspection gateway 116 delegatesintrospection of access token 112 to one of third-party authorizationservers 122 for third-party authorization services 124. In thisillustrative example, introspection gateway 116 and third-partyauthorization servers 122 for third-party authorization services 124 arein communication with each other over network 136.

As depicted, introspection gateway 116 is a single introspectionendpoint for resource server 106. Introspection gateway 116 selectsthird-party authorization server 128 from a plurality of third-partyauthorization servers 122 to handle introspection request 114.Introspection gateway 116 also determines a protocol for third-partyauthorization server 128 and converts introspection request 114 intothird-party request 126 used by third-party authorization server 128 inthird-party authorization servers 122 to introspect access token 112using the protocol identified.

Introspection gateway 116 sends third-party request 126 to third-partyauthorization server 128 and, in response, receives third-party response130 from third-party authorization server 128. Introspection gateway 116converts third-party response 130 into resource server response 118 andsends resource server response 118 to resource server 106. In additionto containing a set of scopes 120, resource server response 118 also cancontain other information such as an indication of whether access token112 is active.

In this manner, resource server 106 uses introspection gateway 116 as asingle introspection endpoint for resource server 106. As a result, theintrospection of the access token 112 is delegated to third-partyauthorization services 124 by introspection gateway 116. This delegationis performed in a manner that is transparent to resource server 106.Further, as changes are made to third-party authorization services 124,changes such as recoding resource server 106 is unnecessary. Asthird-party authorization services 124 are changed to add, remove, orchange third-party authorization servers 122, changes can be made tointrospection gateway 116 to communicate with third-party authorizationservers 122. In the illustrative examples, the manner in whichintrospection gateway 116 communicates with resource server 106 does notchange when changes are made to third-party authorization servers 122.

One or more solutions are present in one or more illustrative examplesthat overcome a problem with changing authorization service providers.As a result, one or more of the illustrative examples may provide atechnical effect providing a single introspection endpoint for aresource server in which introspection of an access token is delegatedto third-party authorization services by the introspection gateway.

As a result, computer system 134 operates as a special purpose computersystem in which introspection gateway 116 in computer system 134 enablesdelegating processing of access tokens received from resource servers.In particular, introspection gateway 116 transforms computer system 134into a special purpose computer system as compared to currentlyavailable general computer systems that do not have introspectiongateway 116.

With reference to FIG. 2, a data flow diagram for handling a clientrequest to access a resource is depicted in accordance with anillustrative embodiment. In the illustrative examples, the samereference numeral may be used in more than one figure. This reuse of areference numeral in different figures represents the same element inthe different figures.

As depicted, client request 200 is received from client 102 by resourceserver 106. Client request 200 is an example of client request 108 inFIG. 1. Resource server 106 sends introspection request 201 tointrospection gateway 116. Introspection request 201 is an example ofintrospection request 114 in FIG. 1.

As depicted, introspection request 201 comprises header 202 and gatewaypayload 204. Header 202 contains information used to route introspectionrequest 201 to introspection gateway 116. A payload is the part of thetransmitted data that is the intended message and excludes headers ormetadata sent to facilitate the delivery of the payload. In thisillustrative example, gateway payload 204 includes access token 206 andresource request 208. Introspection request 201 is in gateway format 210which is recognized and used by introspection gateway 116.

In this example, introspection gateway 116 selects third-partyauthorization server 128 to introspect access token 206. With thisselection, introspection gateway 116 identifies the protocol used bythird-party authorization server 128. Introspection gateway 116 convertsintrospection request 201 into third-party request 212.

As depicted, third-party request 212 comprises header 214 andthird-party request payload 216. Third-party request 212 has third-partyformat 218. Header 214 is utilized to route third-party request 212 tothird-party authorization server 128. Third-party request payload 216 isin a format utilized by third-party authorization server 128.

In the illustrative example, third-party authorization server 128returns third-party response 220. In this illustrative example,third-party response 220 also has third-party format 218 recognized byintrospection gateway 116 in this illustrative example. As depicted,third-party response 220 comprises header 222 and third-party responsepayload 224. Third-party response payload 224 comprises a set of scopes226 and token indication 228. The set of scopes 226 identifies resourcesthat can be accessed by the client. Token indication 228 indicateswhether access token 206 is active.

In turn, introspection gateway 116 converts third-party response 220into resource server response 230, which has resource server format 232utilized by resource server 106. Resource server response 230 is anexample of resource server response 118 in FIG. 1.

Resource server response 230 comprises header 234 and resource serverpayload 236. Header 234 is utilized to route resource server response230 to resource server 106. Resource server payload 236 contains a setof scopes 226 and token indication 228 in resource server format 232.Resource server response 230 is sent to resource server 106.

Thus, resource server 106 only needs to know the protocol to communicatewith introspection gateway 116. Introspection gateway 116 uses protocolsto communicate with third-party authorization servers 122 forthird-party authorization services 124. As a result, introspectiongateway 116 can be updated to take into account changes to third-partyauthorization services 124 without needing changes to resource server106.

The illustrations of resource access environment 100 is depicted in FIG.1 and FIG. 2 are not meant to imply physical or architecturallimitations to the manner in which an illustrative embodiment may beimplemented. Other components in addition to or in place of the onesillustrated may be used. Some components may be unnecessary. Also, theblocks are presented to illustrate some functional components. One ormore of these blocks may be combined, divided, or combined and dividedinto different blocks when implemented in an illustrative embodiment.

For example, resource server 106 and introspection gateway 116 are shownas separate components in this illustrative example. In otherillustrative examples, resource server 106 and introspection gateway 116can be located in the same data processing system. As another example,one or more resource servers can be present in resource accessenvironment 100 in addition to or in place of resource server 106. Theseresource servers also can send introspection requests to introspectiongateway 116. In another illustrative example, one or more introspectiongateways may be present in addition to or in place of introspectiongateway 116. These introspection gateways also may see requests from oneor more resource servers.

Turning next to FIG. 3, a flowchart of a process for third-partyauthorization to access a resource server is depicted in accordance withan illustrative embodiment. The process illustrated in FIG. 3 can beimplemented in resource server 106 in FIG. 1. The process begins byreceiving a client request from a client (step 300). The client requestincludes an access token. Further, the request can include a request toperform an action. This request can be, for example, an OAuth request toaccess information on a website or some other resource on a network,such as the Internet. If the request is to access a bank server, therequest may include requests to perform some action that requires aprivilege to a resource in addition to containing the access token. Theaccess may be for a resource such as account balance, transfer money, orsome other resource at the bank server.

The process sends an introspection request for an access token to anintrospection gateway (step 302). The introspection request is based onthe client request. The process receives a resource server response fromthe introspection gateway (step 304). The response identifies a set ofscopes for the access.

A determination is made as to whether the access token has sufficientscope from the response (step 306). Responsive to a determination thatthe access token has sufficient scope, the process provides the clientaccess to the resource server (step 308). The process terminatesthereafter.

Otherwise, the process returns an error (step 310), with the processterminating thereafter without granting access to the resource server.For example, the request is to access the resource for transfer moneyany set of scopes does not include this resource, then an error isreturned.

With reference next to FIG. 4, a flowchart of a process for delegatingintrospection of an access token is depicted in accordance with anillustrative embodiment. The process illustrated in FIG. 2 can beimplemented in introspection gateway 116 in FIG. 1.

The process begins by receiving an introspection request from a resourceserver (step 400). This request is in a format utilized by anintrospection gateway such that the introspection gateway functions as asingle introspection endpoint for the resource server. As depicted, therequest from the resource server contains the type of OAuth Server. Thisinformation can be present in the resource server for each resource. Theprocess selects a third-party authorization server in third-partyauthorization servers to handle the introspection request (step 402).

The process determines a protocol for the third-party authorizationserver (step 404). The process converts the introspection request into athird-party request used by the third-party authorization server tointrospect an access token using the protocol (step 406). The processsends the third-party request to the third-party authorization server(step 408).

The process receives a third-party response from the third-partyauthorization server (step 410). The process converts the third-partyresponse into a resource server response (step 412). The process sendsthe resource server response to the resource server (step 414), with theprocess terminating thereafter.

The flowcharts and block diagrams in the different depicted embodimentsillustrate the architecture, functionality, and operation of somepossible implementations of apparatuses and methods in an illustrativeembodiment. In this regard, each block in the flowcharts or blockdiagrams may represent at least one of a module, a segment, a function,or a portion of an operation or step. For example, one or more of theblocks may be implemented as program code, hardware, or a combination ofthe program code and hardware. When implemented in hardware, thehardware may, for example, take the form of integrated circuits that aremanufactured or configured to perform one or more operations in theflowcharts or block diagrams. When implemented as a combination ofprogram code and hardware, the implementation may take the form offirmware. Each block in the flowcharts or the block diagrams may beimplemented using special purpose hardware systems that perform thedifferent operations or combinations of special purpose hardware andprogram code run by the special purpose hardware.

In some alternative implementations of an illustrative embodiment, thefunction or functions noted in the blocks may occur out of the ordernoted in the figures. For example, in some cases, two blocks shown insuccession may be performed substantially concurrently, or the blocksmay sometimes be performed in the reverse order, depending upon thefunctionality involved. Also, other blocks may be added in addition tothe illustrated blocks in a flowchart or block diagram.

Turning now to FIG. 5, a block diagram of a data processing system isdepicted in accordance with an illustrative embodiment. Data processingsystem 500 may be used to implement computer system 134, resource server106, introspection gateway 116, or third-party authorization servers123, including third-party authorization server 128 as shown in FIG. 1.

In this illustrative example, data processing system 500 includescommunications framework 502, which provides communications betweenprocessor unit 504, memory 506, persistent storage 508, communicationsunit 510, input/output (I/O) unit 512, and display 514. In this example,communications unit 510 may take the form of a bus system.

Processor unit 504 serves to execute instructions for software that maybe loaded into memory 506. Processor unit 504 may be a number ofprocessors, a multi-processor core, or some other type of processor,depending on the particular implementation.

Memory 506 and persistent storage 508 are examples of storage devices516. A storage device is any piece of hardware that is capable ofstoring information, such as, for example, without limitation, at leastone of data, program code in functional form, or other suitableinformation either on a temporary basis, a permanent basis, or both on atemporary basis and a permanent basis. Storage devices 516 may also bereferred to as computer-readable storage devices in these illustrativeexamples. Memory 506, in these examples, may be, for example, arandom-access memory or any other suitable volatile or non-volatilestorage device. Persistent storage 508 may take various forms, dependingon the particular implementation.

For example, persistent storage 508 may contain one or more componentsor devices. For example, persistent storage 508 may be a hard drive, asolid state hard drive, a flash memory, a rewritable optical disk, arewritable magnetic tape, or some combination of the above. The mediaused by persistent storage 508 also may be removable. For example, aremovable hard drive may be used for persistent storage 508.

Communications unit 510, in these illustrative examples, provides forcommunications with other data processing systems or devices. In theseillustrative examples, communications unit 510 is a network interfacecard.

Input/output unit 512 allows for input and output of data with otherdevices that may be connected to data processing system 500. Forexample, input/output unit 512 may provide a connection for user inputthrough at least one of a keyboard, a mouse, or some other suitableinput device. Further, input/output unit 512 may send output to aprinter. Display 514 provides a mechanism to display information to auser.

Instructions for at least one of the operating system, applications, orprograms may be located in storage devices 516, which are incommunication with processor unit 504 through communications framework502. The processes of the different embodiments may be performed byprocessor unit 504 using computer-implemented instructions, which may belocated in a memory, such as memory 506.

These instructions are referred to as program code, computer usableprogram code, or computer-readable program code that may be read andexecuted by a processor in processor unit 504. The program code in thedifferent embodiments may be embodied on different physical orcomputer-readable storage media, such as memory 506 or persistentstorage 508.

Program code 518 is located in a functional form on computer-readablemedia 520 that is selectively removable and may be loaded onto ortransferred to data processing system 500 for execution by processorunit 504. Program code 518 and computer-readable media 520 form computerprogram product 522 in these illustrative examples. In the example,computer-readable media 520 is computer-readable storage media 524.

In these illustrative examples, computer-readable storage media 524 is aphysical or tangible storage device used to store program code 518rather than a medium that propagates or transmits program code 518.Alternatively, program code 518 may be transferred to data processingsystem 500 using a computer-readable signal media. The computer-readablesignal media may be, for example, a propagated data signal containingprogram code 518. For example, the computer-readable signal media may beat least one of an electromagnetic signal, an optical signal, or anyother suitable type of signal. These signals may be transmitted over atleast one of communications links, such as wireless communicationslinks, optical fiber cable, coaxial cable, a wire, or any other suitabletype of communications link.

The different components illustrated for data processing system 500 arenot meant to provide architectural limitations to the manner in whichdifferent embodiments may be implemented. The different illustrativeembodiments may be implemented in a data processing system includingcomponents in addition to or in place of those illustrated for dataprocessing system 500. Other components shown in FIG. 5 can be variedfrom the illustrative examples shown. The different embodiments may beimplemented using any hardware device or system capable of runningprogram code 518.

Thus, the illustrative examples provide a computer implemented method, acomputer system, and a computer program product for third-partyauthorization. In one illustrative example, a resource server runs on acomputer system. The resource server receives a client request from aclient in which the client request includes an access token. Theresource server sends an introspection request to an introspectiongateway, wherein the request is introspection of the access token basedon the client request, wherein the introspection gateway uses athird-party authorization server from a plurality of third-partyauthorization servers to handle the introspection request. The resourceserver receives a response from the introspection gateway. The responseidentifies a set of scopes for the access. A determination is made as towhether the access token has sufficient scope from the resource serverresponse. The resource server grants the client access to the resourceserver in response to the access token having sufficient scope.

In this manner, a resource server can use an introspection gateway as asingle introspection endpoint for the resource server. As a result, theintrospection of access tokens is delegated to third-party authorizationservices by the introspection gateway. This delegation is performed in amanner that is transparent to resource server. Further, as changes aremade to the third-party authorization services, changes such as recodingor patching resource servers are unnecessary.

The descriptions of the various embodiments of the present inventionhave been presented for purposes of illustration, but are not intendedto be exhaustive or limited to the embodiments disclosed. Manymodifications and variations will be apparent to those of ordinary skillin the art without departing from the scope and spirit of the describedembodiment. The terminology used herein was chosen to best explain theprinciples of the embodiment, the practical application or technicalimprovement over technologies found in the marketplace, or to enableothers of ordinary skill in the art to understand the embodimentsdisclosed here.

The flowchart and block diagrams in the figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof code, which comprises one or more executable instructions forimplementing the specified logical function(s). It should also be notedthat, in some alternative implementations, the functions noted in theblock may occur out of the order noted in the figures. For example, twoblocks shown in succession may, in fact, be executed substantiallyconcurrently, or the blocks may sometimes be executed in the reverseorder, depending upon the functionality involved. It will also be notedthat each block of the block diagrams and/or flowchart illustration, andcombinations of blocks in the block diagrams and/or flowchartillustration, can be implemented by special purpose hardware-basedsystems that perform the specified functions or acts, or combinations ofspecial purpose hardware and computer instructions.

What is claimed is:
 1. A method for third-party authorization, themethod comprising: receiving, by a resource server in a computer system,a client request from a client, wherein the client request includes anaccess token; sending, by the resource server, to an introspectiongateway, an introspection request for the access token based on theclient request, wherein the introspection gateway uses a third-partyauthorization server from a plurality of third-party authorizationservers to handle the introspection request; receiving a resource serverresponse from the introspection gateway, wherein the resource serverresponse identifies a set of scopes for the access token; determiningwhether the access token has sufficient scope from the resource serverresponse; and responsive to the access token having the sufficientscope, granting the client access to the resource server.
 2. The methodof claim 1 further comprising: converting the introspection request intoa third-party request used by the third-party authorization server tointrospect the access token; sending the third-party request to thethird-party authorization server; receiving a third-party response fromthe third-party authorization server; converting the third-partyresponse into the resource server response; and sending the resourceserver response to the resource server.
 3. The method of claim 2 furthercomprising: selecting, by the introspection gateway, the third-partyauthorization server in the plurality of third-party authorizationservers to handle the introspection request; determining a protocol forthe third-party authorization server; and wherein converting theintrospection request into the third-party request used by thethird-party authorization server to introspect the access tokencomprises: converting the introspection request into the third-partyrequest used by the third-party authorization server to introspect theaccess token using the protocol.
 4. The method of claim 2, whereinconverting the introspection request into the third-party request usedby the third-party authorization server comprises: converting a payloadin the introspection request into a format used by the third-partyauthorization server.
 5. The method of claim 3, wherein the resourceserver response comprises the set of scopes and an indication of whetherthe access token is active.
 6. The method of claim 1, wherein theresource server uses the introspection gateway as a single introspectionendpoint for the resource server in which introspection of the accesstoken is delegated to third-party authorization services by theintrospection gateway.
 7. The method of claim 1, wherein the accesstoken is an OAuth token.
 8. A computer system comprising: a resourceserver running on the computer system, wherein the resource serverreceives a client request from a client in which the client requestincludes an access token; sends an introspection request to anintrospection gateway, wherein the introspection request is forintrospection of the access token based on the client request and,wherein the introspection gateway uses a third-party authorizationserver from a plurality of third-party authorization servers to handlethe introspection request; receives a response from the introspectiongateway, wherein the response identifies a set of scopes for the accesstoken; determines whether the access token has sufficient scope from aresource server response; and grants the client access to the resourceserver in response to the access token having the sufficient scope. 9.The computer system of claim 8 further comprising: an introspectiongateway that converts the introspection request into a third-partyrequest used by the third-party authorization server to introspect theaccess token; sends the third-party request to the third-partyauthorization server; receives a third-party response from thethird-party authorization server; converts the third-party response intothe resource server response; and sends the resource server response tothe resource server.
 10. The computer system of claim 9, wherein theintrospection gateway selects one of the plurality of third-partyauthorization servers to handle the introspection request; determines aprotocol for the third-party authorization server; and wherein inconverting the introspection request into the third-party request usedby the third-party authorization server to introspect the access token,the introspection gateway converts the introspection request into thethird-party request used by the third-party authorization server tointrospect the access token using the protocol.
 11. The computer systemof claim 10, wherein in converting the introspection request into thethird-party request used by the third-party authorization server, theintrospection gateway converts a payload in a resource server requestinto a format used by the third-party authorization server.
 12. Thecomputer system of claim 10, wherein the resource server responsecomprises the set of scopes and an indication of whether the accesstoken is active.
 13. The computer system of claim 8, wherein theresource server uses the introspection gateway as a single introspectionendpoint for the resource server in which the introspection of theaccess token is delegated to third-party authorization services by theintrospection gateway.
 14. The computer system of claim 8, wherein theaccess token is an OAuth token.
 15. A computer program product forthird-party authorization, the computer program product comprising: acomputer-readable storage media; first program code, stored on thecomputer-readable storage media, for receiving a client request from aclient, wherein the client request includes an access token; secondprogram code, stored on the computer-readable storage media, for sendingto an introspection gateway, an introspection request for the accesstoken based on the client request, wherein the introspection gatewayuses a third-party authorization server from a plurality of third-partyauthorization servers to handle the introspection request; third programcode, stored on the computer-readable storage media, for receiving aresponse from the introspection gateway, wherein the response identifiesa set of scopes for the access token; fourth program code, stored on thecomputer-readable storage media, for determining whether the accesstoken has sufficient scope from the response; and fifth program code,stored on the computer-readable storage media, granting the clientaccess to a resource server in response to the access token having thesufficient scope.
 16. The computer program product of claim 15 furthercomprising: sixth program code, stored on the computer-readable storagemedia, for converting the introspection request into a third-partyrequest used by the third-party authorization server; seventh programcode, stored on the computer-readable storage media, for sending thethird-party request to the third-party authorization server; eighthprogram code, stored on the computer-readable storage media, forreceiving a third-party response from the third-party authorizationserver; ninth program code, stored on the computer-readable storagemedia, for converting the third-party response into a resource serverresponse; and tenth program code, stored on the computer-readablestorage media, for sending a resource server response to the resourceserver.
 17. The computer program product of claim 16 further comprising:the sixth program code, stored on the computer-readable storage media,for selecting one of a plurality of third-party authorization servers tohandle the introspection request; the seventh program code, stored onthe computer-readable storage media, for determining a protocol for thethird-party authorization server; and the eighth program code, stored onthe computer-readable storage media, for converting the client requestinto the third-party request to introspect the access token.
 18. Thecomputer program product of claim 16, wherein the sixth program codecomprises: program code, stored on the computer-readable storage media,for converting a payload in a resource server request into a format usedby the third-party authorization server.
 19. The computer programproduct of claim 16, wherein the resource server response comprises theset of scopes and an indication of whether the access token is active.20. The computer program product of claim 15, wherein the resourceserver uses the introspection gateway as a single introspection endpointfor the resource server in which introspection of the access token isdelegated to third-party authorization services by the introspectiongateway.